New worms on the Internet using the vulnerability described in the MS05-039 security article from Microsoft updated 8/18/2005, 11:10 AM

There are new worms that have been detected in the wild that spread by exploiting a Microsoft Windows vulnerability MS05-039 vulnerability.

For stand alone removal of these worms it is recommended to follow the below order of operations:

1. Remove machine from the network (unplug LAN cable)
2. Apply Microsoft Patch MS05-039
3. Run the stand alone removal tools from McAfee, Symantec and Microsoft
4. Update the antivirus software to the latest Dat or Definition
5. Run a system scan

Removal Tools

McAfee Stinger v2.5.6 (and later) virus removal tool
Symantec Zotob removal tool
Microsoft virus removal tool v1.7a

McAfee has released SuperDat 4560 (And later) to detect and remove the latest (8/17/05 10:00 AM) variants of these worms. The SuperDat is available here.

Symantec has released definitions dated 8/17/2005 to detect and remove the latest (8/17/05 10:00 AM) variants of these worms. These definitions are available through the LiveUpdate feature of Symantec Antivirus.

Important information from Microsoft regarding this patch is at:

http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx

Additional information from McAfee and Symantec:

McAfee

• http://vil.mcafeesecurity.com/vil/content/v_135491.htm W32/IRCbot.worm!MS05-039 from McAfee.
• http://vil.nai.com/vil/content/v_135493.htm W32/SDBot from McAfee.
• http://vil.nai.com/vil/content/v_135475.htm W32.Zotob from McAfee.

Symantec

• http://securityresponse.symantec.com/avcenter/venc/data/w32.esbot.a.html w32.esbot.a from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.esbot.b.html w32.esbot.b from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.a.html w32.zotob.a from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.b.html w32.zotob.b from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.c@mm.html w32.zotob.c@mm from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.d.html w32.zotob.d from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.e.html w32.zotob.e from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.f.html w32.zotob.f from Symantec.
• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.g.html w32.zotob.g from Symantec.

This archive is not intended to be comprehensive. For a more complete virus library, please visit NAI's Virus Information Library at http://vil.nai.com.